Merge pull request #16253 from argotorg/fix_gh_rate_limit_on_circleci

Use a read-only GitHub token when retrieving PR information

Author: r0qs

.circleci/config.yml

@@ -142,8 +142,8 @@ commands:
             FOUNDRY_REPO="foundry-rs/foundry"
             FOUNDRY_VERSION="<< parameters.version >>"
             # Make authenticated requests when the Github token is available
-            if [[ -n "$GITHUB_ACCESS_TOKEN" ]]; then
-              EXTRA_HEADERS=(--header 'Authorization: Bearer '"${GITHUB_ACCESS_TOKEN}")
+            if [[ -n "$GITHUB_READ_TOKEN" ]]; then
+              EXTRA_HEADERS=(--header 'Authorization: Bearer '"${GITHUB_READ_TOKEN}")
             fi
             FOUNDRY_RELEASE_SHA=$(curl \
               --silent \
@@ -1418,8 +1418,8 @@ jobs:
           name: Retrieve EDR latest release tag
           command: |
             # Make authenticated requests when the Github token is available
-            if [[ -n "$GITHUB_ACCESS_TOKEN" ]]; then
-              EXTRA_HEADERS=(--header "Authorization: Bearer ${GITHUB_ACCESS_TOKEN}")
+            if [[ -n "$GITHUB_READ_TOKEN" ]]; then
+              EXTRA_HEADERS=(--header "Authorization: Bearer ${GITHUB_READ_TOKEN}")
             fi
             EDR_LATEST_RELEASE_TAG=$(
               curl \

scripts/common/rest_api_helpers.py

@@ -84,10 +84,13 @@ def __init__(self, project_slug: str, debug_requests: bool):
         self.debug_requests = debug_requests
 
     def pull_request(self, pr_id: int) -> dict:
+        # GITHUB_READ_TOKEN should be a PAT with read-only permissions
+        # This is used by CircleCI and local scripts to avoid GitHub API rate limits
+        headers = {'Authorization': f'Bearer {environ.get("GITHUB_READ_TOKEN")}'} if 'GITHUB_READ_TOKEN' in environ else {}
         return query_api(
             f'{self.BASE_URL}/repos/{self.project_slug}/pulls/{pr_id}',
             {},
-            {},
+            headers,
             self.debug_requests
         )